How to Check SSL Certificate Expiry and Security Grade

You usually discover an SSL certificate problem at the worst possible moment. A customer sends a screenshot of a browser warning. A checkout stops loading. An uptime alert says the HTTPS connection failed even though the website looked fine yesterday.

The certificate itself may be expired, but that is only one possibility. The server could be presenting a certificate for the wrong hostname. The certificate might not be valid yet because a clock is wrong. An intermediate certificate may be missing. Or the certificate may be healthy while an insecure script or image is creating a completely different mixed-content warning.

This guide shows you how to check an SSL certificate’s expiry date and security grade, read the important fields, and diagnose the result without treating every warning as the same problem.

Check the exact hostname visitors use

Start with the public hostname, not a vague version of the brand name. example.com, www.example.com, shop.example.com, and api.example.com can use different certificates or terminate TLS on different servers. One may work while another fails.

Enter that hostname into the CachePlex SSL Certificate Checker. The tool connects to port 443, retrieves the certificate the server presents, and reports its dates, hostname coverage, issuer, public-key details, signature algorithm, Subject Alternative Names, and the length of the presented certificate chain.

What an SSL certificate check can tell you

A useful report separates identity, time, and cryptography. Each answers a different question.

Validity dates

The valid from date marks the beginning of the certificate’s accepted lifetime. The valid to date is its expiry. A certificate outside that window should trigger a critical result. The remaining-days count is operationally more useful than the raw date because it tells you how much time you have to investigate renewal.

Do not wait for zero. If renewal is automated, a shrinking countdown can reveal that automation has silently failed. Check the certificate again after a renewal and confirm the public server is presenting the new one; obtaining a certificate and deploying it are separate steps.

Hostname coverage

The browser must receive a certificate covering the exact hostname in the address bar. Modern certificates normally list hostnames in the Subject Alternative Name field, usually shortened to SAN.

A wildcard such as *.example.com can cover shop.example.com, but it does not normally cover the bare example.com address and it does not stretch across multiple label levels such as checkout.shop.example.com. Include each required hostname deliberately.

Issuer and subject

The issuer identifies the certificate authority that signed the certificate. The subject identifies the entity or hostname represented by it. These fields help you spot a staging certificate, an unexpected provider, or an old certificate being served by one node behind a load balancer.

Public-key type and size

The report identifies common RSA and ECDSA public keys and their size. For RSA, keys below 2048 bits are a clear warning sign. ECDSA uses much smaller numeric key sizes by design, so an ECDSA number should not be compared directly with an RSA number.

Signature algorithm

The certificate’s signature algorithm shows how its issuer signed it. Modern certificates use SHA-2 family algorithms. MD5 and SHA-1 are obsolete for this purpose and deserve immediate investigation if they appear.

Presented chain

A server normally sends its leaf certificate plus the intermediate certificates a client needs to build a path to a trusted root already held by the browser or operating system. If that chain is incomplete, the site may work on one device because it cached the missing intermediate and fail on a clean or older device.

What the CachePlex grade means

The CachePlex A+–F grade is a quick certificate-health summary. It considers the validity window, hostname match, time remaining, public-key strength, and signature algorithm. An expired, not-yet-valid, or hostname-mismatched certificate receives an F because the identity check has fundamentally failed.

The grade is deliberately practical, but it is not a claim that every possible TLS setting has been tested. A complete server-security assessment can also include supported protocol versions, cipher suites, session behavior, revocation status, HTTP security headers, and client compatibility. Treat the grade as a fast certificate check, then investigate the server more deeply when the application is sensitive or the result conflicts with a browser.

How to diagnose the most common SSL failures

The certificate has expired

Renew or replace it immediately, deploy the renewed certificate to every TLS endpoint, and restart or reload the relevant service if your platform requires it. Then check the public hostname again. A frequent mistake is successfully renewing a file on disk while the web server, proxy, or CDN continues serving the old certificate.

If several servers sit behind a load balancer, test repeatedly or test each origin through your infrastructure controls. One forgotten node can create an intermittent warning that seems to disappear whenever an engineer looks at it.

The certificate expires soon

Confirm that automated renewal is enabled and has recently succeeded. Check whether the renewal process can write to the expected path and whether the service reload step works. Also confirm that DNS still points to the system where the renewal challenge is being answered.

A short certificate lifetime is not inherently weak. Short-lived certificates are designed to renew automatically. The risk is not the duration; it is automation that nobody monitors.

The certificate is not valid yet

First check the clock on the affected device and the server. A badly incorrect system time can make a perfectly legitimate certificate appear premature. If clocks are correct, confirm that the server is presenting the intended certificate and that its validity window has actually begun.

The domain does not match

Compare the tested hostname with every SAN in the certificate. Pay attention to the bare domain versus www, regional hostnames, application subdomains, and old aliases that still receive traffic. Reissue or replace the certificate with the required names, then make sure the virtual host for that domain selects it.

On shared infrastructure, a configuration error can cause the server to present another site’s default certificate. That does not necessarily mean the certificate authority made a mistake; it often means the server selected the wrong virtual host during the TLS handshake.

The certificate chain is incomplete

Install the intermediate bundle supplied by the certificate authority and configure the server to present the full chain file, not only the leaf certificate. Avoid sending the root certificate unless your platform specifically requires it; clients normally already trust roots through their local stores.

The key or signature is weak

Reissue the certificate with a modern key and signature configuration. Do not try to repair the old certificate in place—the relevant cryptographic choices are made when the key and certificate request are created and when the certificate is issued.

The TLS connection cannot be established

Confirm that the hostname resolves, port 443 is reachable, the server is listening for TLS, and a firewall or proxy is not refusing the connection. If the website uses a nonstandard HTTPS port, remember that the CachePlex checker tests the normal public HTTPS service on port 443.

Why a browser can still warn when the certificate looks valid

A certificate report answers certificate questions. It cannot explain every security indicator on a rendered page.

• Mixed content: an HTTPS page loads a script, image, font, or frame over HTTP. Fix the resource URLs and any redirects behind them.
• Client-specific trust: an older device may lack a root certificate or support needed by a newer chain.
• Revocation or policy behavior: browsers and operating systems can apply rules beyond the basic fields in a quick certificate inspection.
• A different hostname: the page may redirect or request assets from another subdomain with its own certificate problem.
• Local interception: corporate security software, antivirus products, captive portals, or a misconfigured proxy can substitute a certificate locally.

When the report looks healthy but one browser still complains, capture the browser’s exact error code and the hostname shown on the warning. That evidence is far more useful than “SSL is broken.”

SSL certificates and SEO: the precise relationship

HTTPS is a lightweight Google ranking signal, but that is not the main SEO risk of an expired or mismatched certificate. The practical problem is access. If Googlebot or a user cannot reliably fetch the canonical HTTPS URL, the page cannot perform normally in search. Redirect loops, broken HTTP-to-HTTPS migrations, and inconsistent canonical URLs can create additional crawling and consolidation problems.

For the broader migration and trust picture, read why HTTPS matters for SEO and users. For an affected page, run the CachePlex SEO Analyzer after the certificate is fixed to check its canonical, headings, metadata, and other on-page signals. This article stays focused on certificate diagnosis so the two guides answer different searches instead of repeating each other.

A maintenance routine that prevents surprise expiries

1. Inventory every public hostname. Include APIs, customer portals, regional sites, redirects, and marketing subdomains.
2. Record the renewal owner. “IT handles it” is not an owner. Name the service, team, or automation responsible.
3. Alert before the emergency window. Use more than one threshold so a missed notification does not become an outage.
4. Test from outside your network. Internal DNS and proxies can hide the certificate actually served to the public.
5. Verify after deployment. Confirm the serial number or validity dates changed on the live endpoint.
6. Keep renewal independent of one person’s laptop. Production renewal belongs in monitored infrastructure.

Quick SSL certificate checklist

• The exact public hostname connects on port 443.
• The current date falls inside the validity period.
• Enough days remain for renewal and deployment.
• The SAN list covers the exact hostname.
• The expected issuer and certificate are being served.
• The public key and signature algorithm are modern.
• The server presents the required intermediate chain.
• HTTP redirects once to the preferred HTTPS URL.
• The HTTPS page declares itself as canonical.
• No page resources are loaded over HTTP.

Frequently asked questions

How can I check when an SSL certificate expires?

Enter the exact hostname in the CachePlex SSL Checker and read the valid-to date and remaining-days count. If the site has several hostnames, check each one separately because they may terminate TLS in different places.

What is the difference between SSL and TLS?

TLS is the modern protocol. “SSL certificate” remains the common name for the certificate used by HTTPS, even though current connections use TLS rather than the obsolete SSL protocol versions.

Does a wildcard certificate cover the root domain?

Not automatically. *.example.com covers one-level subdomains such as www.example.com, but the certificate should also list example.com when the bare domain needs coverage.

Why does the renewed certificate still show the old expiry date?

The new certificate may not have been deployed, the web server may need a reload, a proxy or CDN may terminate TLS in front of the origin, or one node may still serve the old file. Check the public endpoint rather than only the server’s certificate directory.

Does an A+ grade guarantee that every TLS setting is secure?

No. It summarizes the certificate checks performed by CachePlex. Protocol versions, cipher suites, revocation behavior, headers, and compatibility can require additional testing.

Can a certificate be valid while the page shows mixed content?

Yes. The main HTTPS connection can have a valid certificate while the HTML requests an insecure HTTP resource. Fix mixed content in the page or application; renewing the certificate will not change those resource URLs.